ayushin Hi, Here is the scenario: We have multiple customers (100s) running home/shop routers most of which are 192.168.[01]/24 range that are running openvpn clients (2.3.2) and we need to be able to access certain machines on the customer networks from our server. To be able to differentiate from customers I've assigned each customer a /24 network from 10.254/16 bloc: client1 192.168.0.1/24 "iroute 10.254.1/24" client2 192.168.0.1/24 "iroute 10.254.2/24" ... client101 192.168.0.1/24 "iroute 10.254.101/24" Now, I need to be able to access 192.168.0.111 of customer client2 and i would like to be able to "telnet 10.254.2.111" And I am able to do just that if I manually add something like: "iptables -t nat -D PREROUTING -d 10.254.2.111 -j DNAT --to-destination 192.168.1.111" on the customer router. My question is how to achieve that without having to manually add nat rules to every customer? Ideally I'd like to do a POSTROUTING DNAT on the server instead, but POSTROUTING is too late for that and I had no luck with `push "client-nat dnat 10.254.2.111 255.255.255.255 192.168.0.111" - nothing gets created in the nat iptables on the client after that. Any creative ideas?
ayushin And while are are the topic, what would be even better is to avoid assigning a virtual network to every client, because in reality we need only one specific port on one specific customer machine, so doing something like below on the server would be the best for us: iptables -t nat -A PREROUTING -p tcp --dport 19102 -j DNAT --to-destination 192.168.0.163:22 --via "customer tunnel" Of course --via does not exist, we could do something with marks, but then again openvpn would not have an idea to which customer to route the traffic internally once the packet leaves the kernel.
TinCanTech Looks like you have exhausted all the options .. If you want some expert help I am available for hire: tincanteksup <at> gmail
ayushin i've got everything working already just need to find a way to push the DNAT rule to the client to avoid manual configuration
TinCanTech Use openvpn --client-nat Yours is the first real world case I've seen that would actually need it.
ayushin @TinCanTech that's what I'm trying to do, but still no joy: on the client: client-nat dnat 192.168.1.0 255.255.255.0 10.254.1.0 expected behavior - when I telnet to 10.254.1.163 9100 i should see packets re-written, but I get only this Jul 12 17:45:57 vpnclient5[1996]: ** CNAT IN BEFORE 10.254.0.1 -> 10.254.1.163 Jul 12 17:45:57 vpnclient5[1996]: write to TUN/TAP returned 60 and there is no AFTER so for some reason the rule doesn't get matched? I'm about to start digging into the sclinat.c code, but if you have an idea why it does not work, i'd love to hear it its 2.3.2 version
ayushin sorry the client-nat line is actually: client-nat snat 10.254.1.0 255.255.255.0 192.168.1.0 i've tried swapping things around but neither worked
ayushin OK, i've got it re-writing with "client-nat snat 192.168.1.0 255.255.255.0 10.254.1.0" (i fail to see the logic in the above) Jul 12 18:06:27 vpnclient5[2889]: ** CNAT IN BEFORE 10.254.0.1 -> 10.254.1.163 Jul 12 18:06:27 vpnclient5[2889]: ** CNAT IN AFTER 10.254.0.1 -> 192.168.1.163 Jul 12 18:06:27 vpnclient5[2889]: write to TUN/TAP returned 60 Jul 12 18:06:27 vpnclient5[2889]: event_wait returned 1 Jul 12 18:06:27 vpnclient5[2889]: read from TUN/TAP returned 40 Jul 12 18:06:27 vpnclient5[2889]: ** CNAT OUT BEFORE 192.168.1.163 -> 10.254.0.1 Jul 12 18:06:27 vpnclient5[2889]: ** CNAT OUT AFTER 10.254.1.163 -> 10.254.0.1 but i can't get a connection established
ayushin OK, so this is solved, finally with: push "client-nat snat 192.168.1.0 255.255.255.0 10.254.1.0" on the server ccd where 192.168.1.0 is the client subnet and 10.254.1.0 is the customer arbitrary assigned virtual network Thanks for the help!
